CVE-2020-29509: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

mediumCVSS 5.6CVE-2020-29509

CSIRTS triage

vendor: Go product: encoding/xmlOtheraffected: all versions

What: The encoding/xml package does not correctly preserve attribute namespace prefix semantics during tokenization round-trips, allowing attackers to craft inputs with conflicting behavior across processing stages.
Who is affected: Go applications using encoding/xml for XML processing on all versions.
Urgency: Medium severity (CVSS 5.6) and not exploited; impacts applications parsing untrusted XML with namespace prefixes.
Action: Update Go to a patched version that fixes attribute namespace prefix handling in encoding/xml.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch encoding/xml

Get an email when a new encoding/xml advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: medium — CVSS 5.6
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-29509

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2020-295092.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 80% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2020-29509	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Dell ECS: Multiple vulnerabilitiescert-bund

Recent advisories for encoding/xml package in

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2020-29511: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of ele…msrc · 2026-08-06